An effective cyber attack detection system based on an improved OMPCA

Countering network threats, particularly intrusions, is a challenging area of research in the field of information security. Intruders use sophisticated mechanisms to hide the attack payload and break the detection techniques. To overcome that, various unsupervised learning approaches from the field of machine learning and pattern recognition have been employed. The most popularly used method is Principal Component Analysis (PCA). It proposes to extract the critical features of a network connection, then, it exploit them to identify the intrusion. However, PCA approach is prone to outliers due to the square G-norm based objective function. As a solution to that, many PCA variants such R1-PCA and G-PCA were proposed. Nevertheless, They still work with the square l 2 -norm distance based mean, which is not the optimal mean. This paper introduces a new variant of PCA namely QR-OMPCA. Firstly, this method integrates the mean calculation into the feature extraction function, such that the optimal mean can be obtained to enhance the intrusion detection accuracy. Secondly, it incorporates a fast QR decomposition. Experiments on KDDcup99 and NSL-KDD datasets confirm the superiority of the proposed method over many PCA variants in terms of intrusion detection accuracy and CPU time reduction.